From 1404ffbb45edae9d26cd139ba957d2a5d2cbdc27 Mon Sep 17 00:00:00 2001 From: Daniel Pouzzner Date: Tue, 4 Aug 2026 01:45:41 -0500 Subject: [PATCH] Makefile.am: add HAVE_FIPS_VERSION_MAJOR / _MINOR / _PATCH to the variables exported to the linuxkm sub-make. linuxkm/Kbuild: * Feature-detect $(intcmp) (GNU make >= 4.4) into $(HAVE_INTCMP). * Derive FIPS_OPTEST_NO_DH from $(HAVE_FIPS_VERSION_MAJOR) via $(intcmp) when available; otherwise $(error) with instructions to supply it on the make command line. When set, build the optest wrapper with -DNO_DH -- DH is not optested at FIPS v7+ even when the module has DH, because its APIs have no FIPS wrappers. * Same $(intcmp)/$(error) treatment for NO_PIE_FLAG (target kernel < 5.11), and change its test from `ifdef NO_PIE_FLAG` to an explicit `ifeq "$(NO_PIE_FLAG)" "0"` so an explicitly-zero value means what it says. * Add $(CFLAGS_AUTO_VECTORIZE_DISABLE) to benchmark.o ccflags-y and drop its unused asflags-y line. --- Makefile.am | 4 +++- linuxkm/Kbuild | 45 ++++++++++++++++++++++++++++++++++++--------- 2 files changed, 39 insertions(+), 10 deletions(-) diff --git a/Makefile.am b/Makefile.am index 62b62042c3..30c3ccdf0e 100644 --- a/Makefile.am +++ b/Makefile.am @@ -246,7 +246,9 @@ if BUILD_LINUXKM CFLAGS_AUTO_VECTORIZE_DISABLE CFLAGS_AUTO_VECTORIZE_ENABLE \ ASFLAGS_FPU_DISABLE_SIMD_ENABLE ASFLAGS_FPU_ENABLE_SIMD_DISABLE \ ASFLAGS_FPUSIMD_DISABLE ASFLAGS_FPUSIMD_ENABLE ENABLED_KERNEL_BENCHMARKS \ - FIPS_FLAVOR + FIPS_FLAVOR HAVE_FIPS_VERSION_MAJOR HAVE_FIPS_VERSION_MINOR \ + HAVE_FIPS_VERSION_PATCH + module: +$(MAKE) -C linuxkm module diff --git a/linuxkm/Kbuild b/linuxkm/Kbuild index b9bf722c2b..3e8deb9628 100644 --- a/linuxkm/Kbuild +++ b/linuxkm/Kbuild @@ -21,6 +21,13 @@ .ONESHELL: SHELL=bash +# $(intcmp ...) requires GNU make 4.4 or later. +ifeq ($(intcmp 1,1,,yes,),yes) + HAVE_INTCMP := yes +else + HAVE_INTCMP := no +endif + ifeq "$(KERNEL_ARCH)" "x86" KERNEL_ARCH_X86 := yes else ifeq "$(KERNEL_ARCH)" "x86_64" @@ -111,6 +118,24 @@ $(LIBWOLFSSL_NAME)-y := $(WOLFSSL_OBJ_FILES) linuxkm/module_hooks.o linuxkm/modu ifeq "$(FIPS_OPTEST)" "1" $(LIBWOLFSSL_NAME)-y += linuxkm/optest-140-3/linuxkm_optest_wrapper.o + # FIPS_OPTEST_NO_DH=1 for FIPS v7 or later, 0 for earlier. Derived from + # $(HAVE_FIPS_VERSION_MAJOR) when $(intcmp) is available; supply it on the + # make command line otherwise. + ifndef FIPS_OPTEST_NO_DH + ifeq "$(HAVE_INTCMP)" "yes" + ifeq "$(HAVE_FIPS_VERSION_MAJOR)" "" + $(error $$HAVE_FIPS_VERSION_MAJOR is unset.) + endif + FIPS_OPTEST_NO_DH := $(intcmp $(HAVE_FIPS_VERSION_MAJOR),7,0,1,1) + else + $(error $$FIPS_OPTEST_NO_DH is unset -- supply FIPS_OPTEST_NO_DH=1 for FIPS v7 or later, or FIPS_OPTEST_NO_DH=0 for earlier.) + endif + endif + ifeq "$(FIPS_OPTEST_NO_DH)" "1" + # Don't optest DH in FIPS v7+ even if the module has DH -- there are no + # FIPS wrappers for its APIs. + linuxkm/optest-140-3/linuxkm_optest_wrapper.o: ccflags-y += -DNO_DH + endif endif WOLFSSL_CFLAGS_NO_VECTOR_INSNS := $(CFLAGS_SIMD_DISABLE) $(CFLAGS_FPU_DISABLE) @@ -129,6 +154,9 @@ ifeq "$(ENABLED_LINUXKM_PIE)" "yes" ifndef NO_PIE_FLAG ifeq ($(KERNEL_ARCH),arm) + ifneq "$(HAVE_INTCMP)" "yes" + $(error $$NO_PIE_FLAG is unset -- supply NO_PIE_FLAG=1 for target kernel <5.11, else supply NO_PIE_FLAG=0.) + endif ifeq ($(intcmp $(VERSION),5,1,0,0),1) NO_PIE_FLAG := 1 $(info Note: disabling -fPIE to avoid R_ARM_REL32 on pre-5.11 target kernel.) @@ -136,15 +164,19 @@ ifeq "$(ENABLED_LINUXKM_PIE)" "yes" ifeq ($(intcmp $(VERSION),5,0,1,0)-$(intcmp $(PATCHLEVEL),11,1,0,0),1-1) NO_PIE_FLAG := 1 $(info Note: disabling -fPIE to avoid R_ARM_REL32 on pre-5.11 target kernel.) + else + NO_PIE_FLAG := 0 endif endif + else + NO_PIE_FLAG := 0 endif endif - ifdef NO_PIE_FLAG - PIE_FLAGS += -DWC_NO_PIE_FLAG - else + ifeq "$(NO_PIE_FLAG)" "0" PIE_FLAGS += -fPIE + else + PIE_FLAGS += -DWC_NO_PIE_FLAG endif # the kernel sanitizers generate external references to # __ubsan_handle_out_of_bounds(), __ubsan_handle_shift_out_of_bounds(), etc. @@ -198,8 +230,7 @@ endif $(obj)/$(LIBWOLFSSL_NAME).mod.o: ccflags-y := $(PIE_SUPPORT_FLAGS) $(obj)/wolfcrypt/test/test.o: ccflags-y += -DNO_MAIN_DRIVER -DWOLFSSL_NO_OPTIONS_H $(obj)/wolfcrypt/src/aes.o: ccflags-y := $(WOLFSSL_CFLAGS) $(WOLFSSL_CFLAGS_YES_VECTOR_INSNS) $(PIE_FLAGS) $(PIE_SUPPORT_FLAGS) -$(obj)/wolfcrypt/benchmark/benchmark.o: ccflags-y := $(WOLFSSL_CFLAGS) $(CFLAGS_FPU_ENABLE) $(CFLAGS_SIMD_ENABLE) $(PIE_SUPPORT_FLAGS) -DNO_MAIN_FUNCTION -DWOLFSSL_NO_OPTIONS_H -$(obj)/wolfcrypt/benchmark/benchmark.o: asflags-y := $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_ENABLE_SIMD_DISABLE) +$(obj)/wolfcrypt/benchmark/benchmark.o: ccflags-y := $(WOLFSSL_CFLAGS) $(CFLAGS_FPU_ENABLE) $(CFLAGS_SIMD_ENABLE) $(CFLAGS_AUTO_VECTORIZE_DISABLE) $(PIE_SUPPORT_FLAGS) -DNO_MAIN_FUNCTION -DWOLFSSL_NO_OPTIONS_H asflags-y := $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPUSIMD_DISABLE) @@ -230,10 +261,6 @@ $(obj)/wolfcrypt/src/wc_mlkem_asm.o: asflags-y := $(WOLFSSL_ASFLAGS) $(ASFLAGS_F $(obj)/wolfcrypt/src/wc_mlkem_asm.o: OBJECT_FILES_NON_STANDARD := y $(obj)/wolfcrypt/src/wc_mldsa_asm.o: asflags-y := $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE) $(obj)/wolfcrypt/src/wc_mldsa_asm.o: OBJECT_FILES_NON_STANDARD := y -# Native Falcon fpr backend: scalar double math on SSE2 (mulsd/divsd/sqrtsd, -# no x87), so it needs the vector insns enabled in the assembler like the other -# _asm.o here. The vector registers are saved at run time by the SAVE_VECTOR_ -# REGISTERS2() wrapping in falcon.c around signing and keygen. $(obj)/wolfcrypt/src/wc_falcon_fpr_x86_64_asm.o: asflags-y := $(WOLFSSL_ASFLAGS) $(ASFLAGS_FPU_DISABLE_SIMD_ENABLE) $(obj)/wolfcrypt/src/wc_falcon_fpr_x86_64_asm.o: OBJECT_FILES_NON_STANDARD := y